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, The construction of a perfectly secure private quantum channel in dimension d is known 

to require 2 log d shared random key bits between the sender and receiver. We show that 
if only near-perfect security is required, the size of the key can be reduced by a factor of 
two. More specifically, we show that there exists a set of roughly d log d unitary operators 
whose average effect on every input pure state is almost perfectly randomizing, as com- 
pared to the d 2 operators required to randomize perfectly. Aside from the private quantum 
channel, variations of this construction can be applied to many other tasks in quantum in- 
formation processing. We show, for instance, that it can be used to construct LOCC data 
hiding schemes for bits and qubits that are much more efficient than any others known, 
allowing roughly log d qubits to be hidden in 2 log d qubits. The method can also be used 
to exhibit the existence of quantum states with locked classical correlations, an arbitrarily 
large amplification of the correlation being accomplished by sending a negligibly small clas- 
sical key. Our construction also provides the basic building block for a method of remotely 
preparing arbitrary d-dimensional pure quantum states using approximately log d bits of 
, communication and log d ebits of entanglement. 
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I. INTRODUCTION 



^ ■ In this paper we revisit the question of finding the minimal resources required to randomize a 

quantum state. This problem has previously been investigated in several variations, always with 
the conclusion that in order to randomize or, more generally, encrypt a quantum state of I qubits, 
21 classical bits of random key are required (ll y. |2D- This factor of 2 represents a familiar and 
even welcome phenomenon in quantum information theory; the reason for its appearance is inti- 
mately connected to the existence of superdense coding All this previous work, however, 
considered only the task of perfectly encrypting quantum states. Here we focus on the task of ap- 
proximately encrypting quantum states, allowing a negligible but non-zero amount of information 
to remain available to an eavesdropper. In sharp contrast to the exact case, in this setting we find 
that the factor of 2 disappears entirely: an l-qubit quantum state can be approximately encrypted 
using I + o(l) bits of random key. 
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Our encryption or, more specifically, randomization scheme also exposes a previously unob- 
served difference between classical and quantum correlations: classical correlations are always 
effectively destroyed by a local randomization procedure whereas quantum correlations need not 
be. Therefore, any correlation that survives local randomization must be "nonlocal" and, hence, 
quantum mechanical in nature. This basic insight provides the intuition behind a new scheme for 
data hiding in a bipartite system The encoding is an approximate randomization proce- 

dure applied collectively to the two /-qubit shares of a 2/-qubit system, calibrated to eliminate all 
correlations that can be detected by local operations and classical communication (LOCC). The 
failure of the encoding to destroy quantum correlations is striking: there exists a collective decod- 
ing operation that recovers all the states on an [I — o(Z)] -qubit subsystem of the input. In other 
words, randomization can be used to construct schemes for LOCC hiding of roughly I qubits in 
a 21-qubit quantum state. This construction is far more efficient than any previously known for 
hiding qubits or even classical bits. 

Another variation on our basic construction can be used to find quantum states whose classical 
correlations are large but locked. Roughly speaking, this means that local measurements can yield 
classical data with only a small amount of correlation but that local operations supplemented with 
a small amount of communication can yield a disproportionately large amount of correlation. The 
existence of such states was demonstrated in Ref. [8] but some central questions about the range 
of possible effects were left open. In particular, the authors defined two figures of merit, one 
measuring the (reciprocal of) amplification of the correlation and the other the ratio of the amount 
of communication to the amount of unlocked correlation. We give the first demonstration that 
both quantities can go to zero simultaneously. While seemingly esoteric, the existence of this 
phenomenon has important implications for the definition of security in quantum cryptographic 
scenarios; in particular, it establishes the potentially enormous volatility of accessible informa- 
tion. There is also an alternative interpretation of this result: we prove that random observables 
typically obey extremely strong entropic uncertainty relations. 

One final application of the ability to randomize an /-qubit state using only I + o(l) random 
key bits has a sufficiently different character that we present it in a separate paper jjj. Insofar as 
teleportation llOfl . or more generally remote state preparation can be interpreted as a method 
for encrypting quantum states 1 12l. ll3ll , our approximate encryption procedure should give rise to 
an approximate remote state preparation method consuming only half as much communication 
as teleportation. We report in 1 9|] how our results on randomization provide the basic building 
block for a protocol capable of sending an arbitrary pure /-qubit quantum state using only I ebits 
and I + o(l) bits of classical communication. 

The rest of the paper is structured as follows. Section [H] describes our results on the private 
quantum channel, which serve as a prototype for the rest of the paper. Section |nT| then studies 
approximately randomizing maps by characterizing their effect on classical and quantum corre- 
lations. These observations are then put to use in slightly modified form in section llVl which 
describes our quantum data hiding protocol and proves both its correctness and security. Section 
Ivl then formalizes the idea of locking classical correlations and describes our contribution. We 
also include an appendix establishing some results on randomization procedures using subsets of 
the unitary group, such as the Pauli matrices. 

We use the following conventions throughout the paper, log and exp are always taken base 
2. Unless otherwise stated, a "state" can be pure or mixed. The symbol for a state (such as ip 
or p) also denotes its density matrix. "Part of an entangled state" refers to a (mixed) state whose 
purification is accessible to some of the parties. We will make an explicit indication when referring 
to a pure state. The density operator \<p){<p\ of the pure state \p) will frequently be written simply 
as p. B(C d ) will be used to denote the set of linear operators from C d to itself and \J(d) c B(C d ) 
the unitary group on C d . 
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Finally, a word of warning about the cryptographic interpretation of our results. When we 
say that a scheme for approximate encryption or quantum data hiding is secure for mixed states, 
it should be assumed that the purifications of those mixed states are inaccessible to all parties 
considered. Indeed, the possibility that purification-inaccessible security criteria can hold even 
as purification-accessible criteria fail is essentially a quantum mechanical re-statement of a famil- 
iar cryptographic observation: approximate security is sometimes much easier to achieve than 
perfect security. We exploit the gap throughout this paper. 



II. AN APPROXIMATE PRIVATE QUANTUM CHANNEL 



We consider an insecure one-way quantum channel between two parties Alice and Bob that 
is noiseless in the absence of eavesdropping. This channel can be made secure against eaves- 
dropping if Alice and Bob are allowed the extra resource of shared random secret key bits. For 
instance, one can encrypt a state \<p) 6 C d using a secret key of length 2 log d as follows tlB]- Fix 
abasis {|1}, . . . , \d)} for C d and let 

X\j) = \(j + l)modd) and Z\j) = e 2 ^' d \j). (1) 

It's straightforward to verify that 

^E^v fc V = i (2) 

3=1 k=l 

for all states ip. If j and k are selected using a shared secret key, Alice can encrypt the state using 
the unitary operation X 7 Z k and Bob can decrypt by applying Z~ k X~ 3 . By Eq. the view of 
an eavesdropper without access to j and k is I/d, which is independent of the input state (p. This 
structure, consisting of a set of encoding maps and decoding maps indexed by key values, such 
that the average encoded state is independent of the input, is known as a private quantum channel 
for C d . (See Ref. |3] for a formal definition.) In fact, ifperfect security is required, it can be shown 
that the secret key must have length at least 2 log d Here we relax the security criterion. 



Definition II.l A completely positive, trace-preserving (CPTP) map R 
randomizing if, for all states tp, 



m - - d 



e 

< - 
~ d 



B(C d ) -► B(C d ) is e- 



(3) 



In the above, || • ||oo is the operator norm, so Eq. {3j is equivalent to all the eigenvalues of R(<p) lying 
in the interval [(1 — e)/d, (1 + e)/d]. By convexity of the norm, it suffices to check the condition 
for all pure states, a fact we will use repeatedly. In quantum information, distinguishability is 
frequently measured using the trace norm ||-||i = Tr|-|, the analogue of variation distance in 
probability theory. Note that Eq. @ automatically implies the weaker estimate ||-R(y?) — V^lli ^ e - 
The main result of this section is 

Theorem II.2 For all e > and sufficiently large d (> ™), there exists a choice of unitaries in U(d), 
{Uj : 1 < j < n} with n = 134d(log d)/e 2 such that the map 



1 n 



(4) 



on B(C d ) is e-randomizing. 
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FIG. 1: A private quantum channel built on the randomization map R. Alice and Bob share knowledge of 
the secret key j, using it to encrypt and decrypt the state. Because an eavesdropper does not have access 
to j, her view is R(ip) ~ 1/d. If ip is a d-dimensional quantum state, then the key length need only be 
logd + o(log d). 



As illustrated in figure^ by having Alice and Bob select j using a shared secret key, this map R can 
be used to build a private quantum channel with key length log n = log d + log log d + log ( 1 / e 2 ) + 8, 
albeit one that is not perfectly secure, only nearly so. The view of an eavesdropper without access 
to the key, given a particular input state tp, is precisely R(<p). Definition lII.ll therefore, doubles as 
a definition of security. For any distribution of states {pi, ipi] supported on C d we can bound the 
mutual information accessible to an eavesdropper who performs measurements on the encrypted 
states R(<pi). This accessible information is bounded above by the Holevo quantity jlS] 



X = S (j2 Pi R(<pi) \ -Y^ Pl S(R(w)) 

< log d-J2piS{R{w)) 

i 

< log(l + e) < e/(ln2). 



(5) 

(6) 
(7) 



The second inequality is true because the definition of e-randomizing maps implies that R(^i) < 
(1 + e)I/d, which allows for an application of the monotonicity of log. In particular, for all a > 0, 

choosing e = (log d)~ a implies that x d ^°°> 0. In this case, n = 134 d (log d)( 1+2a \ so the key size 
can be taken to be log d + (1 + 2a) log log d + 8. Alternatively, one can choose an arbitrarily small 
a > 0, and let e = d~ a . Then, x < d~ a /(ln2) which is exponentially decaying in the number 
of qubits to be encrypted, log d. This comes at the cost of a slight increase in the asymptotic key 
length: log n = (1 + 2a) log d + log log d + 8. Moreover, as is common with probabilistic existence 
proofs, it is possible to ensure that the overwhelming majority of random choices succeed at only 
minor additional cost; in this case, log n would need to be increased by a constant number of bits 
for any fixed probability of success. Analogous statements hold for our other constructions later 
in the paper. 

The proof of theorem lII.2l is based on a large deviation estimate, lemma llL3l and discretization 
via a net construction, lemma 111.41 both of which will be re-used in other applications later in 
the paper. The large deviation estimate, in turn, is based on Cramer's theorem (see Ref. [15], 
for example, for a detailed exposition), which states that for independent, identically distributed 
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(i.i.d.) real-valued random variables, X, X\, X2, ■ ■ ■ , X n , 



x) I and 



where 



A* (x) = sup 



Ax — In Ee 



(8) 
(9) 

(10) 



A*(x) is known as the rate function and Ee AX the moment generating function. (In fact, the harder 
part of Cramer's theorem deals with the optimality of the rate function. We only need bounds 
JSJ and © here, which are surprisingly easy to prove: they require only the Bernstein trick and 
Markov's inequality.) 

Lemma II.3 Let ipbea pure state, P a rank p projector and let (Uj)j>i be an i.i.d. sequence ofU(d)-valued 
random variables, distributed according to the Haar measure. There exists a constant C (C > (61n2) _1 ) 
such that if < e < 1, 



Pr 



> ? I < 2exp (-Cnpe 2 ) 



(11) 



Proof Since the Haar measure is left and right invariant, we may assume that tp = | 1)(1| and P = 

Z)f=i l*X*l f° r some fixed orthonormal basis {\i)}. Let \gf) = Yli=i 9ijV)i where the i.i.d. complex 
random variables gij ~ iVc(0, 1). (That is, the real and imaginary parts of gij are independent 
gaussian random variables with mean and variance 1/2.) The distribution of \gj) is the same 
as the distribution for ||<7j||2 Uj\l). For a fixed j, let U = Uj and \g) = \gj). The convexity of exp 
implies that 



A 



E 9 ex P lEl^ 9 



i=l 



i=l 



> E aexp (E s ^J>|[/|l)f 



Ec/exp (A^|(i|C/|l)| : 



(12) 

(13) 

(14) 
(15) 

This inequality between moment generating functions establishes, via Cramer's theorem, that the 
rate function for the random variable Tv(UifU^ P) and the rate function A* for ^ Yn=i \ (^\s)\ 2 
are related by the inequality A*(x) < Aj^(x). It follows from the definitions that A*(px/d), in turn, 
is equal to pA*(x), where A* is the rate function for \gij\ 2 . Therefore, 



i=l 



Euexp(xTr(U^P)) . 



Pr 



(it^UjP) - 5 > f J < exp (-^gV^) 



(16) 
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The rate function A* can be evaluated directly, with the result that A*(l + e) > Ce 2 , where C can 
be chosen to be the constant (6 In 2) _1 [9]. Repeating the argument for deviations below the mean 
and applying the union bound completes the proof. □ 
As an aside, we note that the probability density function for Tr ■(UjcpUjP) was recently calculated 
exactly by Zyczkowski and Sommers jlfll . In principle, this should allow for an exact calculation 
of the rate function At 



Lemma II.4 For < e < 1 and dimH = d there exists a set M of pure states in H with \M\ < (5/e) 



2d 



such that for every pure state \tp) eH there exists \<p) € M with 
set an e-net.) 



|(/?)((/?| — \$){if>\ < e- (Wecallsucha 



Proof We begin by relating the trace norm to the Hilbert space norm: 

2 



> i 



- 2Re (tp\(p) 

-Mv)\ 2 



(17) 



where the last line can be shown by evaluating the eigenvalues of \(p){(p\ — \ Thus it will be 
sufficent to find an e/2-net for the Hilbert space norm. Let M. = {\<fii) : 1 < i < m} be a maximal 
set of pure states satisfying \\\(pi) — \ipj) \\2 > e/2 for all % and j. (Such a set exists by Zorn's lemma.) 
By definition, M. is an e/2-net for || • || 2 . We can then estimate m by a volume argument. As subsets 
of M. 2d , the open balls of radius e/4 about each \tpj) are pairwise disjoint and all contained in the 
ball of radius 1 + e/4 centered at the origin. Therefore, 



m(e/4) M < (l + e/4) 



2d 



(18) 



□ 



Proof (Of theorem lII.2t Let {Uj)j>\ be i.i.d. U(d)-valued random variables, distributed according 
to the Haar measure. We will show that with high probability the corresponding R in Eq. l|4|l is 
e-randomizing. The proof will consist of bounding 



Pr sup 



u 





l= p „ r l 


I 


oo / 


sup sup 







3=1 




(19) 



The optimizations over ip and tp can both be taken over pure states only by the convexity of 
Fix a net of projectors M = {X} and let (p be the net point corresponding to ip so that 



sup \\tp 



(20) 
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Define $ similarly. Lemma llL4l provides a net with \M\ < (^M} 2d . We can then proceed as follows: 



Pr sup sup 



u 



3=1 
+ 



1 1 

/ i n i 

< Pr ( sup sup - \&(Uj<pUj1>) ~ TbiUjtptffy 

L 

n 
3=1 



(21) 



< Pr I sup sup 



3=1 




In the last inequality, we used the estimate 



TrlUjipUU) -Tr [UjipWiJ; 



J 3^j 



rt„ 



3 j 



(22) 



(23) 



which, because ip — (p and ip — ip are traceless and either zero or rank 2, is equal to ^\\(p — <^||i + 
IH^/j — -0||i. This sum is then less than or equal to e/{2d) by construction of the net. 

Next, we replace the optimization over the set of all pure states in Eq. El by optimization 
over the net, use the union bound and apply lemma HO 



Pr I max 



u 



,i> e M 



n 



3=1 



> 



2d 



< \M\ max Pr 

Cp,i> e M U 



1 n 1 



< 



v) 



id 



exp 



re . 
5=1 

Cree 2 



> 



2ri 



(24) 

(25) 
(26) 



where C > (6 In 2) _1 is the same constant as in the proof of lemma llL3l The existence of the desired 
e-randomizing map is guaranteed if the above probability is bounded away from 1, which is the 
case if n > ^4 log(— ). If d > — , this is true when when n > 192(ln 2)e~ 2 dlogd. 



□ 



III. RANDOMIZATION AND THE DESTRUCTION OF CORRELATIONS 

Our discussion in the previous section demonstrates that a quantum operation R constructed 
by averaging over 134d(log d)/e 2 randomly selected unitaries will be e-randomizing with high 
probability In this section, our goal will be to investigate the properties of general e-randomizing 
maps so the method used to construct R will be immaterial as long as 

\\R{fp)-\U<2 < 27 ) 

for all ip. The definition, it should be noticed, makes no mention of the effect of R on a system 
that is correlated with another system (we call this the "environment")- Here we will analyze that 
effect, which will ultimately lead to a partial characterization of all e-randomizing maps. 
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To start, it is easy to verify that an e-randomizing R properly destroys classical correlations 
between the system being randomized and its environment: 



Lemma III.l Let p m = Yli pi (pf <8 tpf be a separable state and R an e-randomizing map on A. Then 



||( J R0/)(p^)-i»^|| 1 < e 



B\ 



Proof This is straightforward: 



|(i?®I)(p^)-i®p B | 



i 

< Y,Pi\\ R (vt)®t. 

i 

= J2Pi\\R(<pt) - l d h 



i 111 



< e. 



(28) 

(29) 

(30) 

(31) 
(32) 



□ 

Thus, for classically correlated states, approximate randomization implies the destruction of cor- 
relations with other systems. Indeed, for classically correlated states, finding an operation that 
will destroy correlations is effectively the same thing as finding an operation that will erase local 
information. 

This equivalence fails dramatically for entangled states. (In contrast, any perfectly random- 
izing map does destroy all possible correlations including entanglement.) Indeed, if we ap- 
ply an R constructed using the method of theorem 111.21 to half of a maximally entangled state 
|$) = A= Ylj=i then the resulting state has rank at most n = o(d 2 ), so 

\\(R ® /)($) - jfl ® I||i < 2(1 - n/d 2 ) 2, (33) 

meaning that (R (8) J)($) and ^1 <g> I can be distinguished by a collective measurement with 
negligible probability of error for large d. It goes without saying then that the approximate ran- 
domization does not eliminate all the correlations that were originally present in the maximally 
entangled state. Nonetheless, the correlations that remain have been rendered invisible to local 
operations and classical communication, recovering at least some of the spirit of lemma ITlI.ll 

Lemma III.2 Let R be an e-randomizing quantum operation, M = {Mi} be a positive operator-valued 
measure (POVM) that can be implemented using LOCC, p i := T Yr{M i (R <g) /)($)) and gj:=Tr(Mj4l). 
Then \\p — q\\\ < e. 

Proof If M can be implemented using LOCC then it will have the separable form Mi = Xi®Yi. 
Moreover, we can assume without loss of generality that Xi and Y\ are rank 1 since refining the 
measurement can only increase the l\ distance between the outcome probability distributions. 
Making use of the identities Y { Tr Y { = Y 2 and (I (8) Yi)$(I (8) YJ) = ^Y^ T (g> Y ir the demonstration is 
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then direct: 



J2\Tr[(Xi®l)(R®I)( 



Yr 



TrY T ® d 



Tr[(Xi®Y)^} 



i 

< ^^Tr(X,)Tr(y t )<e, 



(34) 
(35) 

(36) 
(37) 



where in the last step we have used that ^ X{ <g> Yi = I and the fact that R is e-randomizing. □ 
A very similar proof demonstrates the more general 

Theorem III.3 Let M = {Mi} be a POVM that can be implemented using LOCC, pi := Tr(M; (R <g> 
I){p AB )) and q t := Tr(M; (|l ® p B )). T/jen ||p - <?||i < e. 

Thus, while some kind of correlation can persevere when half of an entangled state is random- 
ized, that correlation will all be inaccessible to LOCC measurements. In fact, the proof shows that 
it will be inaccessible to all measurements that can be implemented using separable superopera- 
tors. It's tempting to speculate that lemma ITlI.21 provides a characterization of all e-randomizing 
operations. There is at least a weak sense in which that is true: if the conclusion of lemma Hll.21 
holds for a map R, then for all states cp, 



11%) 



i < e. 



(38) 



Recall that this condition is weaker than the operator norm definition of e-randomization that we 
use, however. This might suggest that our definition is too strong and that this trace norm version 
might be more easily characterized. Unfortunately, our proof of lemma ITlI.21 makes explicit use of 
the stronger condition. We don't know if it would hold for R only satisfying Eq. J38b . The fact that 
e-randomizing maps render the correlations of entanglement invisible to LOCC also raises the 
question of their relationship to the phenomenon of quantum nonlocality without entanglement 
The range of connections between e-randomizing maps and the physics of nonlocality will 
be further developed in a upcoming paper jlill . 



IV. QUANTUM DATA HIDING 

Theorem lIII.3l also immediately suggests another application of e-randomizing maps: quantum 
data hiding, the name given to schemes for sharing bits or qubits between multiple parties in such 
a way that the data cannot be accessed by LOCC operations alone. We will focus on the bipartite 
case, where our methods provide a protocol for hiding I qubits in a bipartite state of roughly 
21 qubits. This is far more efficient than previous constructions for hiding either bits or qubits, 
where the best previous constructions gave ratios that depended on the security requirements. To 
achieve 5 = e = 1/16 in terms of the parameters introduced below, for example, the separable 
Werner state construction of Ref. |5] requires roughly 24 qubits per hidden bit. (Using, in the 
notation of that paper, K = 4 and d = 64.) To achieve qubit hiding, the construction of Ref. 
would have multiplied that overhead by a further dimension-dependent factor. (We note that 
by making additional assumptions about the operations available to the parties, it is possible to 
improve on the 1 : 2 ratio between hidden and physical qubits. It was recently discovered, for 
example, that in some systems with superselection rules, a ratio of 1 : 1 is achievable 1 19].) 
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Definition IV.l (Adapted from Ref. 1 6]) A (5, e,p, g)-qubit hiding scheme consists of a CPTP en- 
coding map E : B(C P ) -» B(C q ) and a CPTP decoding map D : B(C q ) -> B(C P ) such that 

1. (Security) For all LOCC measurements L, as well as all states <po and <pi on C p , 

\\L(E(<po)) -LiEM^Ke. (39) 

2. (Correctness) For all states <p on C p , \\(D o E)(<p) — ip\\i < S. 

The security criterion obviously implicitly assumes some bipartite structure C q = Ha ®T~Lb- In 
our constructions, we will set d\m(7iA) = dim(H.B) = d. Our main result is 

Theorem IV.2 For all 5, e > (satisfying e 2 log(40/<5 2 ) < 1) and sufficiently large d (d > 
maxj^p-, -y/15/e, 21}), one can construct a (5, e,p, d 2 )-qubit hiding scheme, with 

C6 2 e 2 d 

P= nm^d- m 

and C = (61n2) _1 . The encoding map is given by 

R( P ) = -J2 u jP u ] ( 41 ) 



n . 



where {Uj} C U(d 2 ), and n = -^dlogd. 

The main point, unfortunately obscured by the proliferation of constants and conditions is simply 
this: for these hiding schemes, the limiting ratio of hidden qubits to physical qubits is 

i im i 12 = o- ( 42 ) 

d^oo log d z 2 

The idea behind our approach is simple. We randomly choose the Uj acting on the AB system. 
With n sufficiently large, we can assure that for all p, R{p) is effectively indistinguishable (by 
LOCC alone) from the maximally mixed state on AB. Then we restrict the input p to have support 
on a sufficiently small subspace S to ensure that the subspaces {UjS} can be reliably distinguished 
by a collective measurement on AB. This strategy is summarized in figure |2j 

We will prove the security and correctness in the next two subsections. 

A. Security of the protocol 

The proof of security uses techniques similar to those in the proofs of lemmas 111.31 and IIII.21 
so we only give the outline here. As usual, let {Uj : 1 < j < n} be U((f 2 )-valued independent 
random variables distributed according to the Haar measure. For < e < 1, 



Pr sup sup 

U l ip£SX®Y 



n 
3=1 



1 

TP 



> JH <2 |ALi| 2 |M P | exp (-^- ) , (43) 



where X and Y are d-dimensional rank 1 projectors acting on A and B respectively, and if G S is 
a p-dimensional pure state (to be hidden). C is the same positive constant as in lemma HOI Md 
and M p are g^-nets for (i-dimensional and p-dimensional rank 1 projectors respectively. Eq. d43l 
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(a) (b) 




FIG. 2: Quantum data hiding, (a) depicts the encoding procedure. A random Uj is applied to the state 
\ip) drawn from subspace S. The output, R(<p), is almost indistinguishable from the maximally mixed state 
using LOCC alone, (b) The different subspaces {UjS} have very small overlaps, however, so a collective 
operation on Ha ® can be used to distinguish them without causing much distortion to the encoded 
states Uj\(p). 



can be proved in a way very similar to lemma ITT731 From lemma HL4l we can choose |A^d| 2 |A^p| = 
(15d 2 /e) 2( - 2d+p \ Whenever d 2 > max(15/e, 16) and n > 33(2d + p)(logd)/(Ce 2 ), the probability in 
Eq. l|43l is strictly less than 1/2, in which case more than half of the choices for {Uj} are such that 
for all ip, M and N, 



n 

Tr[i^(M®iV)C/ iV C/j 



i=i 



i 

TP 



< 



(44) 



To finish the proof of security we use arguments similar to those in lemma IIII.2I Let Uj be 
chosen so that R(<p) = ± YTj=\ u j<P U j satisfies Eq. (04j. Let {X t ® Y { } be any POVM implemented 
by LOCC, where Xi and Yi are both rank 1. For any state ip G S, let pi = Tr((Xj (8) Yi)R(p)) and 
q i = Tr((X i ®Y i )jz). Using Eq. we find 



IIP 



= \ T ^((Xi Yi)R{p)) - j, Tr(Xi ig) Yi)\ 

i 



(45) 
(46) 



Therefore, when the conditions stated above on n, d and e are satisfied, the security condition is 
fulfilled with probability at least 1/2 for a random selection of unitaries. 



B. Correctness of the protocol 

To complete the construction of the data hiding scheme, we must also show that the decoding 
can be performed reliably. Let S be a fixed subspace of dimension p in Ha <8> T~L b ar id let P be the 
projector onto S. Our decoding procedure will be given by the transpose channel [20], a generaliza- 
tion of the pretty good measurement jH. Specifically, let N = YJl=i UiPU} and A = PUjN- 1 / 2 . 
Our decoding procedure D will be given by performing the quantum operation with Kraus ele- 
ments D{. Our proof that this decoding procedure works is via a reduction to the task of decoding 
classical data, for which there are well-known criteria for the success of the pretty good measure- 
ment 122]. 
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Fixing < a < 1, our goal will be to ensure that \(<p\ DiUi\ip)\ 2 > 1 — a for all i = 1, . . . ,n and 
whenever \ip) 6 S. Then, (ip\DoR(ip)\ip) > 1—a. It would then follow by standard inequalities 123] 
that || D o R(ip) — <p\\i < 2^/a and, choosing a = 5 2 /4, that the correctness criterion is satisfied. 
To begin, fix any basis £ = {\j)} for S. Our strategy is to first show that, for any given i and \ 
the operation D decodes Ui\j) correctly with high probability by relating D to the pretty good 
measurement for decoding classical messages. We then show that D succeeds on all pure input 
states by verifying that it succeeds simultaneously on a large enough set of bases to effectively 
cover the set of all states. 

So, consider decoding the classical messages i = 1, ••• ,n and j = 1, • • • ,p by applying 
the pretty good measurement to the set of states {Ui\j)}ij. The POVM elements are Mij = 
N^^Uilj^jlujN- 1 / 2 . This POVM can be implemented in two stages: first D is applied and 
the outcome i is recorded, then the projective measurement onto the basis £ is performed. To see 
this, observe that 

(j\D iP D}\j) = (jlPUjN-^pN-^UiPlj) (47) 
= WtN-WpN-WUilj) (48) 
= Tr(pik%). (49) 

In particular, this calculation also demonstrates that 

\(j\DiUi\j)\ 2 = TrmmujMij) (50) 

so the decoding procedure D succeeds on \ j) provided that for each i, the pretty good measure- 
ment identifies Ui\j) with high probability. Applying the criterion of Hausladen et al. for the 
success of the pretty good measurement |22], we find that 

i - \imum 2 < ^ ■= E lO'i^'iiOi 2 - (si) 

Notice that terms for which j' ^ j and i' = i do not contribute to Ajj so its expectation value is 

EtfA fj = EE^Pc/^liXil^^'li'Xi'l^] (52) 

which is small provided np <C d 2 . We will be interested in 

Pr(A, J >(l + r / )^), (54) 
which by the left invariance of the Haar measure is equal to 



pHEEioi^'iiOi^a+r/)^). (55) 



Invoking lemma HOI with rj = 1/2, the state and projector YTj'=x li'Xi'l' m e probability that 

n-r 



Aij exceeds 3 ^ n 2d P P is less than or equal to exp(— C (n — 1) p/4) for the same positive constant C in 
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lemma HOI By the union bound, the probability that this bad event happens for at least one of the 
choices off is less than or equal to nexp(— C (n— l)p/4): 

Pr Lin|(i|AC/i|i)| 2 < 1 - < nexp(-C(n - l)p/4). (56) 

Now, as discussed earlier, our goal is to verify that \(ip\DiUi\ip)\ 2 will be large for all \cp) G S. 
Fix an f -net for pure states on S. The size of this net can be taken to be less than or equal to (^) 2p . 
Extend each net point (p to a basis of S. We have 

Pr (mmmm|(^|A£/#}| 2 < 1 - < (^) 2p n exp(-f (n-l)p) (57) 

by Eq. {l56l and the union bound. The probability of D failing on at least one net point is less than 
1/2 if n > § log(ifi) + + Otherwise, 

\{ip\DiUi\tp)\ 2 > MD.UiM 2 -^{D^M 2 -MD^m 2 

> 1 " ~ f = 1 " « (58) 

for all 1 1/?) G S 1 by choosing 3(n — l)p/d 2 = a. 

That is essentially the end of the proof. All that remains is to make appropriate choices for 
our various parameters. Collecting all our requirements, we find that the correctness condition 
\\D o R((p) — ip\\\ < 5 for all tp is satisfied with probability at least 1/2 if 

n>§log(^) + Al^ + 1) (59) 

a = <5 2 /4 and 3(n — l)p/d 2 = a. Recall that the security criterion is satisfied with probability at 
least l/2providedn > 33(2d + p) (log d)/(Ce 2 ) and d > max(Y / 15/e, 4). Restricting to p < d,we 
make the choice 

99 n , , , Ce 2 5 2 d 

n = Tni dlogd, andthen p = — — — - — -. (60) 
Ce A 1188 log a 

If, in addition, d > max(^p-,21) and log(40/<5 2 ) < 1/e 2 , a straightforward calculation shows 
that all our requirements are met. Therefore, by the union bound, the probability that both the 
correctness and security criteria are satisfied is greater than for a random choice of R. As an 
example, when e = 8 = and d is sufficiently large, logp > log d — log log d — 30. Finally, both 
5 and e can be chosen to be any polynomial in without affecting the asymptotic efficiency, 
and can be chosen to be d~ a for small a > in order to achieve security that is exponential in 
2 log d, the number of physical qubits, at the expense of a slightly reduced asymptotic efficiency 
(1-4q)/2. 



V. LOCKING CLASSICAL CORRELATIONS 



Define the maximum classical mutual information that can be obtained by local measurements 
X (g> Y on a bipartite state pab as 

I c (p) = max X0 y I(x : y), (61) 

where x and y are random variables representing the outcomes of measurements X and Y on 
Pab and I(x : y) is equal to H(x) + H(y) — H(x, y) for the Shannon entropy H. Now suppose 
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that p' AB is obtained from pab by communicating I classical bits present in Alice's system to Bob. 
There are natural cryptographic reasons to worry about the relationship between I c (p), I c {p') 
and /. Suppose, for example, that an eavesdropper, initially uncorrelated with a quantum state, 
can extract I c {p) bits of mutual information about some secret classical data by performing a 
measurement on the state. If instead the eavesdropper started with / classical bits potentially 
correlated with the secret, one would hope that the most the eavesdropper could learn upon 
performing her measurement would be less than I c (p)+ID bits for some constant D. The existence 
of locked classical correlations in the form presented here demonstrates that such bounds fail 
drastically in general. As a consequence then, it is generally much more prudent to use the Holevo 
X quantity instead of the accessible information when bounding an eavesdropper's information, 
(x does obey simple bounds of the desired type.) 

In their paper introducing the idea of locked classical correlations, DiVincenzo et al. 1 8] defined 
two figures of merit, 

^ = ¥rk and r *= T (^ 1 rev ^ 

Ic{P) I C {P') - Ic(P) 

Ideally, the two should be small simultaneously: the first is the ratio of the initial to the final 
information while the second measures the ratio of the "key length" to the unlocked information. 
In their paper, they found examples for which (n, r 2 ) ~ (3, and (n, r 2 ) ~ (jlE^d^ \)- Here 
we show that r\ and r 2 can be made arbitrarily small at the same time, meaning that the amount 
of information unlocked is large relative both to the amount of information originally available 
and relative to the number of classical bits communicated from Alice to Bob. 

Theorem V.l For all e, 5 > there exist bipartite states pab with n < e and r 2 < 5. Alice's system 
may be taken to be a classical system of 'log d + 3 log log d bits and Bob's a quantum system of 'log d qubits 
provided e is smaller than some fixed constant, log d > log (where C" is a positive constant) and 

3 log logd 

5 (l-e/W (63) 

As in the original work, the states we consider will have the form 

d 

ill) 



1 •* " 

P AB = T Yl 12 I'JXvU ® {Uj\i)(i\U}) B , (64) 



=1 J=l 



where the {|u)a} and {\i) b} are orthonormal, d = dim(B) and the Uj are unitary. Thus, j can be 
thought of as a label describing which orthonormal basis is used on Bob's system to encode i. For 
such states, a convexity argument (see Ref. |8]) quickly implies that 

I c (p)< log d + m a x^^Y,\^\ U M 2 ^gMU J \i}\ 2 . (65) 

The communication of j, which requires I = log n bits, obviously yields a state p 1 for which 
I c {p') = logd + logn so an investigation of the locking properties of p will hinge on bounding 
the second term of Eq. ll65l . Letting pji = \(ip\Uj\i)\ 2 and pj = (pji, . . . ,Pjd), this second term 
is equal to — i J2j H(Pj)- (Note that pji and pj are functions of tp, although we have suppressed 
the dependence in our notation.) As usual, we will proceed by selecting the operators Uj at ran- 
dom using the Haar measure, in which case this average entropy quantity will be provably large. 
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Indeed, a now familiar type of calculation (see appendix|BJ with the substitution e i— ► e/2) demon- 
strates that there is a positive constant C" such that 

mf-E^fe)<(l-6/2)logd-3j <(f) 2d exp(-n( 3 ^g F -l)) , (66) 

provided e < 2/5 and d> 7. Choosing n = (log ci) 3 and log d to be larger than log then en- 
sures that the probability is bounded away from 1. It's worth pausing to interpret this statement: 
it means that there is a choice of n bases that is highly incommensurate with all states ip, in the 
sense that averaged over bases, the entropy of the probability distribution induced by measuring 
any fixed ip is almost maximal. Returning to locking, we see that there exists a choice of unitaries 
such that 



hip) < log d - [(1 - e/2) log d - 3] = § log d + 3. (67) 
We can then estimate, using the facts that 3/ log d < e/2 and d>7, 



2 log d + 3 



n < < e (68) 

log a + 3 log log d 

3 log log d 

2 ~ (1 -e/2) log d 1 ' 

The general mathematical question we addressed in this section amounts to quantifying the 
constraints imposed by entropic uncertainty relations I2I, on typical observables, an inter- 
esting problem in its own right, regardless of its connection to locking classical correlations. As 
such, and acknowledging that the approximations used here were quite crude, it would be worth 
developing a more detailed understanding of the distribution of the quantity min^ Y^j=\ H(Pj)- 



VI. DISCUSSION 



We have explored a range of cryptographic applications that are based on concentration phe- 
nomena in high-dimensional inner product spaces. Most results in quantum information theory 
exploit regularities in the structure of the input or operations; Schumacher's quantum noiseless 
coding theorem |2fl. l26Tl. for example, is based on the fact that for large I, a state p® 1 will be almost 
entirely supported on an l(S(p) + <5)-qubit subspace. The results we presented here are of a related 
but different character: the regularity we exploit is inherent in the structure of C d and, therefore, 
doesn't require any additional constraints. 

Our first application was to demonstrate the existence of approximate private quantum chan- 
nels capable of achieving exponential security (as measured, for example, by an eavesdropper's 
accessible information) in the number of encrypted qubits while simultaneously using only about 
half as much key as the well-known perfectly secure constructions. The failure of bounds on 
the size of the secret key from the exact case to apply in our approximate setting exposed a new 
distinction between quantum and classical correlations: classical correlations must be destroyed 
by local randomization operations while quantum correlations can survive such operations. Our 
second application built on this principle to find protocols for LOCC hiding of bipartite quantum 
states capable of encoding roughly I qubits in 21 qubits, a significant improvement over previous 
constructions. We ended by exhibiting states with locked classical correlations. Such states can 
be used to perform surprising communication tasks but also serve as a warning that accessible 
information is a potentially volatile measure for use in security definitions. 
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Our results here suggest a number of possible directions for future research. One natural ques- 
tion is the optimality of the cryptographic protocols we've described. While a simple rank ar- 
gument ensures that the 1 : 1 asymptotic ratio of secret key bits to encoded qubits achieved by 
our approximate private quantum channel is optimal assuming a unitary encryption map, there 
appear to be technical obstacles to proving optimality in case of CPTP encryption maps with un- 
bounded output dimension. (If the size of the encrypted state is a polynomial function of the 
size of the message then the proof is straightforward. One need only combine the argument of 
Ref. |6], Section IV with the Fannes inequality H2|.) Optimality of the 1 : 2 ratio found for quan- 
tum data hiding represents an even bigger challenge; we know of no convincing argument, beset 
by technical obstacles or not. At a finer level of detail, since our focus has been on asymptotic 
rates, we haven't made any serious attempt to optimize the constants in our constructions; it 
is likely that significant improvements and perhaps simplifications could be found, particularly 
in the estimates leading to the locking result. Finally, from a practical point of view, the most 
pressing problem would be to find computationally efficient versions of the constructions we 
have presented here. Our Appendix A provides one step in this direction in the case of approxi- 
mate private quantum channels: instead of selecting unitary transformations from the full unitary 
group, it suffices to select them at random from the set of products of Pauli operators. This ran- 
dom selection is easily done in polynomial time and the Pauli operators are easily implemented. 
Unfortunately, since the number of random selections is exponential in the number of encrypted 
qubits, this simplification does not yet yield a polynomial time construction. 
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APPENDIX A: BEYOND HAAR MEASURE 

For some applications, a randomization procedure using a different distribution over unitaries 
would be preferable; in data hiding, for example, proving that the decoding procedure succeeds 
with high probability would have been greatly facilitated by using Pauli operators instead of 
arbitrary unitaries. The convenience appears to come at a price, however. Rather than the strong 
operator norm estimate of section^ we have only been able to prove the corresponding result in 
trace norm for the general case. 

Throughout, we assume only that {Uj : 1 < j < n} are independent U(d)-valued random 
variables with density p(U) such that KUjipUj = I/d. The density function p(U), for example, 
could consist of point masses concentrated at tensor products of Pauli operators. 



Lemma A.l For a fixed pure state ip,E[\\^ Y^j=\ UjtpUj 



< y/dfn. 



Proof First we evaluate 



E 



n 4-i 1 d 



3=1 



1 

d' 



(Al) 
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The expectation value is easy to calculate: 



-+E Tr (^) 

, n(n—l) 



(A2) 
(A3) 
(A4) 



Therefore, E[^|| Y%=i UjipUj — ^|||] = 4^r- ^ e Cauchy-Schwartz inequality and the concavity 
of the square-root function, we can then estimate 



E 



n ^ 3 3 d 



i=i 



< VdE 



3 3 d 



1/2 



The lemma then follows by substitution and the trivial inequality d — 1 < d. 
We'll also make use of Azuma's inequality: 



(A5) 



(A6) 



□ 



Lemma A.2 Let (Yj)j=i be a sequence of real-valued random variables such that \Yj\ < 1. Let S n 



Pr ( -S„ >tl< exp ' } 



Proof See, for example, Ref. [HJ. 



(A7) 
□ 



Theorem A.3 For sufficiently large d and n = d\og d/e 2 , there exists a choice of {Uj} 7 -^ in the support 
ofp such that the inequality 



i=i 



^ d 



< e 



(A8) 



holds for all states (p. 

Proof For n, k > 1, let Z n = || ££ =1 U jV U] - nl/d||i, S k = E[Z n \U u . . . , U k ] - E[Z n ] and Y k 
S k — Sk-i- It's also convenient to introduce the notation So = Yq = 0. Note that 



E[Yfc|5 fc _i] = E\E[S k \U li ...,U k - 1 ]-S k - 1 \S k - 1 ] = 0. 
Also, for fixed (Ui, . . . , J7 n ) and unitary U k , the triangle inequality gives 

nl 



(A9) 



E^W 

3=1 



~d 



Tt 

k d 



< \\U k <pUl-U k <pUhi<2 



(A10) 
(All) 
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so |Yfc| < 2. An application of lemma lA~2l to S n = Ylk=i ^fc then tells us that 



Pr (Z„ - E[Z n ] > 2nt) < exp 



-nV 



(A12) 



By the previous lemma, if n > Ad/5 2 , then E[Z n ] < n5/2. Therefore, when this condition holds, 
we find that 



Pr (Z n > nS) < exp 
Fix an e/2-net M with \M\ < (10/e) M . Then 



Pr I sup 



"J 



> ne 




max 


r j 













-n5 2 
32 



(A13) 



nl 
1 



> 



ne 



(A14) 



By the union bound and our previous calculations, this probability is less than or equal to 

If n = dlog d/e 2 , then this quantity goes to zero with increasing d. 

APPENDIX B: PROOF OF EQ. 466) 

Our goal is to prove that there is a positive constant C" such that 



(A15) 
□ 



Pr finf -S^Hfa) < (l-e)logd-3^ < (^) M exp 
V f n / — f / e 

.7 = 1 7 



„ ( eC"d 
11 \ 2(log d)' 2 



where pji = \(i\uj\<p)\ 2 . 

We begin by estimating the concentration of measure for the entropy of measurement of a 
random state. Let \ip) be a pure state chosen from the unitarily invariant measure on C d , % = 
|(i|V>)| 2 and /(IV')) = H(q) the Shannon entropy of the distribution q. We use a version of Levy's 
Lemma 1281: 



(Bl) 



Lemma B.l (Levy) Let f : S k 1 — > R be a function with Lipschitz constant a. Then 

Pr (|/ - E/| > 77) < 4exp {-C'ktfjo 2 ) , 
for Haar measure on S^ 1 and C > 1/(220 In 2) a constant. 

For our application, k = 2d and the Lipschitz constant can be expressed in terms of the qo 

4 d 

cT 2 = S upV/-V/ = ^-^^(l + ln ft ) 2 



< 



< 



(In 2) 



(In 2) 



i=l 
d 



J>(l + (ln % ) 2 ) 



i=l 



[l + (\nd) 2 ) <8(logd) 2 , 



(B2) 

(B3) 
(B4) 
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where the second inequality, true if d > 3, can be shown using Lagrange multipliers. The expec- 
tation value of / is logd — A(d), with A(d) = log d — (| + | + • • • J)/(ln2), which converges to 
(1 — 7)/ (In 2), where 7 is Euler's constant (approximately 0.577) [29]. Using the estimate ] 30] 



2(d 



L_y<x;I- M - 7 <i, OB) 



we can guarantee that 1/2 < A(d) < 1 if d > 7. Thus, choosing 77 = 2 — A(d) and setting 
C" = C'/8, we find 

Pr(#(g)<logd-2)<4ex P (- — — ^ J . (B6) 

We now move on to bounding £)j=i H(Pj) for a given yj. This is easily done using the Chernoff 
bound 1 15]: if X\, . . . , X n are i.i.d. random variables such that Xj G [0, 1] and EX = \i > a > 0, 
then 

(1 n \ 
-^Xj < a) < exp (- nD(a\\fJL)j (B7) 

where D(-||-) is the binary divergence function 

D(a\\fi) = a log a — a log /x+ (1 — a) log(l — a) — (1 — a) log(l — /i) . (B8) 

Let Xj = whenever H(pj) < logd — 2 and Xj = 1 otherwise. Then (log<i — 2)Xj < H(pj) and 
by Eq. flSJ, E v Xj > 1 - 4 exp (-dC"/ (log cf) 2 ). Choosing a = l- |and/x = EyX,- in the Chernoff 
bound, we find 

1 n 

Pr(-^lffo)<(l-f)(logd-2)) < exp (-nZ>(l- |||1 -4exp(^)). (B9) 

i=l 

The divergence can be bounded as follows: 

/ \ fdC" 

^(l-f||l-4ex P (^ F )) > -F (e /2)- e + ^-^ (BIO) 

> edC " 1 mil 

The first inequality arises by neglecting the mixed term corresponding to a log fi in the divergence, 
since it is always nonnegative. The second is valid whenever e < 1/5, which we assume from now 
on. 

To extend Eq. <B9ll to all possible states, choose an §-net M for ci-dimensional pure states, with 
\M\ = (10/e) M . Write <p for the net point corresponding to ip. Let pj be as previously defined in 
terms of ip, and p~j be similarly defined in terms of (p. Using the union bound, 

Pr (gift ~ n £ ff fe> S (1 - DOcgi - 2)) < |W|=P [ - n(^ ¥ - l)] . (B12) 

Furthermore, viewing pj and pj as postmeasurement states, the monotonicity of the trace norm 
implies 

l|Pi-Pilli<f- (B13) 
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Then, applying Fannes' inequality 1 27] to the distributions pj and pj, 

\H( Pj ) - H(pj)\ < | logd - § log | < § logd + 1. (B14) 
A substitution then completes the proof. 



[1] S. Braunstein, H.-K. Lo, and T. Spiller. Forgetting qubits is hot to do. Unpublished manuscript, 1999. 
[2] P. O. Boykin and V. Roychowdhury. Optimal encryption of quantum bits. arXiv quant-ph/ 0003059. 
[3] A. Ambainis, M. Mosca, A. Tapp, and R. de Wolf. Private quantum channels. In IEEE Symposium on 

Foundations of Computer Science (FOCS), pages 547-553,2000. arXiv quant-ph/ 0003 101. 
[4] C. H. Bennett and S. Wiesner. Communication via one- and two-particle operators on Einstein- 

Podolsky-Rosen states. Phys. Rev. Lett., 69(20):2881-2884, 1992. 
[5] F. Eggeling and R. F. Werner. Hiding classical data in multi-partite quantum states. Phys. Rev. Lett., 

89(9):097905, 2002. arXiv quant-ph/0203004. 
[6] D. P. DiVincenzo, P. Hayden, and B. M. Ferhal. Hiding quantum data. Found. Phys., 33(11):1629-1647, 

2003. arXiv quant-ph/0207147. 
[7] D.P DiVincenzo, D. W. Leung, and B. M. Ferhal. Quantum data hiding. IEEE Trans. Inf. Theory, 

48(3)580-598,2002. arXiv quant-ph/0103098. 
[8] D. P. DiVincenzo, M. Horodecki, D. Leung, J. Smolin, and B. M. Ferhal. Locking classical correlation 

in quantum states. arXiv quant-ph/0303088. 
[9] C. H. Bennett, P. Hayden, D. Leung, P. W. Shor, and A. Winter. Remote preparation of quantum states. 

arXiv quant-ph/0307100. 

[10] C. H. Bennett, G. Brassard, C. Crepeau, R. Jozsa, A. Peres, and W. K. Wootters. Feleporting an 
unknown quantum state via dual classical and Einstein-Podolsky-Rosen channels. Phys. Rev. Lett., 
70:1895-1899, 1993. 

[11] H.-K. Lo. Classical-communication cost in distributed quantum-information processing: A general- 
ization of quantum-communication complexity. Phys. Rev. A, 62:012313, 2000. 

[12] D. Leung. Quantum vernam cipher. Quantum Info. Comp., 2:14-34, 2001. 

[13] D. Leung and P. Shor. Oblivious remote state preparation. Phys. Rev. Lett., 90:127905, 2003. 

[14] A. S. Holevo. Statistical problems in quantum physics. In G. Maruyama and J. V. Prokhorov, editors, 
Proceedings of the second Japan-USSR Symposium on Probability Theory, volume 330 of Lecture Notes in 
Mathematics, pages 104-119, Berlin, 1973. Springer- Verlag. 

[15] A. Dembo and O. Zeitouni. Large deviations techniques and applications. Springer- Verlag, New York, 
1993. 

[16] K. Zyczkowski and H.-J. Sommers. Fruncations of random unitary matrices. /. Phys. A, 33:2045-2057, 
2000. 

[17] C. H. Bennett, D. P. DiVincenzo, C. A. Fuchs, F. Mor, E. Rains, P. W. Shor, J. A. Smolin, and W. K. 

Wootters. Quantum nonlocality without entanglement. Phys. Rev. A, 59(2):1070-1091, 1999. arXiv 

quant-ph/9804053. 
[18] P. Hayden. Spin-cycle entanglement. In preparation. 

[19] F. Verstraete and J. I. Cirac. Quantum nonlocality in the presence of superselection rules and some 

applications. arXiv quant-ph/ 0302039. 
[20] M. Ohya and D. Petz. Quantum entropy and its use. Fexts and monographs in physics. Springer- Verlag, 

Berlin, 1993. 

[21] P. Hausladen and W. K. Wootters. A pretty good measurement for distinguishing quantum states. /. 

Mod. Opt., 41:2385-2390, 1994. 
[22] P. Hausladen, R. Jozsa, B. Schumacher, M. Westmoreland, and W. K. Wootters. Classical information 

capacity of a quantum channel. Phys. Rev. A, 54:1869-1876, 1996. 
[23] C. A. Fuchs and J. van de Graaf. Cryptographic distinguishability measures for quantum mechanical 

states. IEEE Trans. Inf. Theory, 45:1216-1227, 1999. arXiv quant-ph/9712042. 
[24] D. Deutsch. Uncertainty in quantum measurements. Phys. Rev. Lett., 50:631-633, 1983. 
[25] H. Maasen and I. Uffink. Generalized entropic uncertainty relations. Phys. Rev. Lett., 60:1103-1106, 

1988. 



21 



[26] B. Schumacher. Quantum coding. Phys. Rev. A, 51:2738-2747, 1995. 

[27] M. Fannes. A continuity property of the entropy density for spin lattice systems. Comm. Math. Phys., 
31:291-294,1973. 

[28] V.D. Milman and G. Schechtman. Asymptotic theory of finite dimensional normed spaces. Number 1200 in 

Lecture Notes in Mathematics. Springer- Verlag, 1986. 
[29] R. Jozsa, D. Robb, and W.K. Wootters. Lower bound for accessible information in quantum mechanics. 

Phys. Rev. A, 49(2):668-677, 1994. 
[30] R. M. Young. Euler's constant. Math. Gaz., 75:187-190, 1991. 



